# Meet Activity

Collects Meet activity logs from Google Workspace for auditing Google Meet usage.

**Sync Type: Incremental**

## Requirements

Before configuring this input, you need to set up a Google Cloud service account and grant it the necessary permissions in your Google Workspace environment. Follow these steps:

1. **Create a Google Cloud Project**:
    - Go to the [Google Cloud Console](https://console.cloud.google.com/).
    - Create a new project or select an existing one.

2. **Enable the Admin SDK API**:
    - In your project, go to "APIs & Services" > "Library".
    - Search for "Admin SDK API" and enable it.

3. **Create a Service Account**:
    - Go to "IAM & Admin" > "Service Accounts".
    - Click "Create Service Account".
    - Give it a name and description.
    - For role, you don't need to grant any roles in Google Cloud.
    - Click "Create and Continue", then "Done".

4. **Generate a Key for the Service Account**:
    - In the service account list, click on your new service account.
    - Go to the "Keys" tab.
    - Click "Add Key" > "Create new key".
    - Choose JSON as the key type and click "Create".
    - Save the downloaded JSON file securely.

5. **Set up Domain-Wide Delegation**:
    - Go to your [Google Workspace Admin Console](https://admin.google.com/).
    - Navigate to Security -> Access and Data Control -> API Controls
    - In the "Domain-wide Delegation" section, click "Add new".
    - For "Client ID", enter the service account's Client ID (found in the JSON key file).
    - For scopes, enter: `https://www.googleapis.com/auth/admin.reports.audit.readonly`
    - Click "Authorize".

6. **Create and Configure an Admin Account**:
    - In the Google Workspace Admin Console, go to Users.
    - Click on "Add new user" to create a new account, or select an existing user.
    - Fill in the required information for the new user.
    - After creating the user, click on the user's name to access their details.
    - In the user details page, find the "Admin roles and privileges" section.
    - Click on "Assign roles".
    - Navigate to "Admin roles" under the Account section.
    - Click "Create new role".
    - Name the role (e.g., "Device Activity Report Reader").
    - Under privileges, expand the "Reports" section.
    - Check the box for "Read" under "Admin Audit Reports".
    - Save the new role.
    - Return to the user's details and assign this new custom role.

## Configuration

The Google Workspace Meet Activity Input is configured using the following settings:

#### Settings

| Setting | Type | Required | Description |
|---------|------|----------|-------------|
| Email | string | Yes | The email address of the Google Workspace admin to impersonate for API calls. |
| Backfill Start Time | string | No | The date to start fetching data from. If not specified, no past records will be fetched. |

#### Secrets

| Secret | Type | Required | Description |
|---------|------|----------|-------------|
| CredentialsJSON | string | Yes | Base64-encoded JSON credentials of the Google Cloud service account used for authentication. |

Remember to keep your service account key confidential and never commit it to version control systems.

## Functionality

This input component performs the following actions:

1. Authenticates with Google Workspace using a service account and admin impersonation.
2. Periodically fetches meet activity logs.
3. Processes and publishes activity data to the pipeline for further handling.

## Best Practices

1. **Service Account**: Use a dedicated service account for this input.
2. **Least Privilege**: Grant only the necessary permissions to the service account.
3. **Admin Impersonation**: Use a dedicated admin account for impersonation, preferably one with limited permissions.
4. **Credential Security**: Keep the service account JSON key secure and never commit it to version control.
5. **Regular Audits**: Periodically review the service account's access and the impersonated admin's permissions.

## Limitations

- The input fetches a maximum of 1000 results per API call.
- Historical data availability depends on Google Workspace's retention policies.
- API quotas and limits apply as per Google Workspace Admin SDK guidelines.

## Troubleshooting

- For authentication errors, verify the service account credentials and Domain-Wide Delegation setup.
- If encountering "permission denied" errors, check the impersonated admin's privileges.
- No data being fetched could indicate a lack of meet activities or logging issues in your Google Workspace.

## Custom Schema Handling

If the source data doesn't align with any of the [OpenSecurityControlFramework (OSCF) schemas](https://schema.ocsf.io/), you can create a custom transformation using our JQ transform pipeline. For example:

```jq
{
  metadata: {
    schema_version: "1.0.0",
    custom_framework: "my_framework"
  },
  controls: .[]
}
```

For more information on JQ and how to write your own JQ transformations see the JQ docs [here](https://jqlang.github.io/jq/).

If you believe this data source should be included in the standard OSCF schema set, please reach out to our team at [support@monad.com](mailto:support@monad.com). We're always looking to expand our coverage of security control frameworks based on community needs.


## Sample Record

```json
{
  "actor": {
    "callerType": "USER",
    "email": "tom.brown@demo.com",
    "profileId": "f74ab3d3-b3b0-6568-9fcf-b0fd02d5512c"
  },
  "etag": "\"etag_example\"",
  "events": [
    {
      "name": "call_ended",
      "parameters": [
        {
          "name": "meeting_code",
          "value": "IFKVRQYHVF"
        },
        {
          "name": "conference_id",
          "value": "iuLVp8xVTkdDFgturB0ODxIXOAIIigIgABgBCA"
        },
        {
          "name": "organizer_email",
          "value": "tom.williams@demo.com"
        },
        {
          "name": "calendar_event_id",
          "value": "5493c82e-12e7-0648-b62d-9596835d47aa"
        },
        {
          "name": "is_external"
        },
        {
          "name": "endpoint_id",
          "value": "2eebc2be-8ed5-d1d0-6c8b-639feacf602f"
        },
        {
          "name": "device_type",
          "value": "web"
        },
        {
          "name": "product_type",
          "value": "meet"
        },
        {
          "name": "display_name",
          "value": "Alice Smith"
        },
        {
          "name": "location_country",
          "value": "US"
        },
        {
          "name": "location_region",
          "value": "San Jose"
        },
        {
          "name": "identifier",
          "value": "sarah.williams@test.com"
        },
        {
          "name": "identifier_type",
          "value": "email_address"
        },
        {
          "name": "start_timestamp_seconds",
          "intValue": "1699995482"
        },
        {
          "name": "duration_seconds",
          "intValue": "1931"
        },
        {
          "name": "ip_address",
          "value": "192.247.126.156"
        },
        {
          "name": "network_rtt_msec_mean",
          "intValue": "269"
        },
        {
          "name": "network_recv_jitter_msec_mean",
          "intValue": "71"
        },
        {
          "name": "network_recv_jitter_msec_max",
          "intValue": "899"
        },
        {
          "name": "network_send_jitter_msec_mean",
          "intValue": "778"
        },
        {
          "name": "network_estimated_upload_kbps_mean",
          "intValue": "7753"
        },
        {
          "name": "network_estimated_download_kbps_mean",
          "intValue": "6870"
        },
        {
          "name": "audio_recv_seconds",
          "intValue": "3385"
        },
        {
          "name": "audio_send_seconds",
          "intValue": "2119"
        },
        {
          "name": "audio_send_bitrate_kbps_mean",
          "intValue": "9098"
        },
        {
          "name": "audio_recv_packet_loss_max",
          "intValue": "38"
        },
        {
          "name": "audio_recv_packet_loss_mean"
        },
        {
          "name": "audio_send_packet_loss_max"
        },
        {
          "name": "audio_send_packet_loss_mean"
        },
        {
          "name": "video_recv_seconds",
          "intValue": "1758"
        },
        {
          "name": "video_send_seconds",
          "intValue": "2471"
        },
        {
          "name": "video_send_bitrate_kbps_mean",
          "intValue": "7049"
        },
        {
          "name": "video_recv_packet_loss_max"
        },
        {
          "name": "video_recv_packet_loss_mean"
        },
        {
          "name": "video_send_packet_loss_max"
        },
        {
          "name": "video_send_packet_loss_mean"
        },
        {
          "name": "video_recv_fps_mean",
          "intValue": "7"
        },
        {
          "name": "video_send_fps_mean",
          "intValue": "44"
        },
        {
          "name": "video_recv_long_side_median_pixels",
          "intValue": "945"
        },
        {
          "name": "video_recv_short_side_median_pixels",
          "intValue": "606"
        },
        {
          "name": "video_send_long_side_median_pixels",
          "intValue": "239"
        },
        {
          "name": "video_send_short_side_median_pixels",
          "intValue": "653"
        },
        {
          "name": "network_congestion",
          "intValue": "8"
        },
        {
          "name": "screencast_recv_seconds"
        },
        {
          "name": "screencast_send_seconds"
        },
        {
          "name": "network_transport_protocol",
          "value": "udp"
        }
      ],
      "resourceIds": [
        "iuLVp8xVTkdDFgturB0ODxIXOAIIigIgABgBCF",
        "IFKVRQYHVG"
      ],
      "type": "call"
    }
  ],
  "id": {
    "applicationName": "meet",
    "customerId": "C023sj8s7",
    "time": "2025-09-12T16:36:43.496524Z",
    "uniqueQualifier": "53b87c58-1e1d-c250-c7a8-499bb5a5e98c"
  },
  "kind": "admin#reports#activity",
  "resourceDetails": [
    {
      "id": "iuLVp8xVTkdDFgturB0ODxIXOAIIigIgABgBCF",
      "type": "CONFERENCE"
    },
    {
      "id": "IFKVRQYHVG",
      "type": "MEETING_SPACE"
    }
  ]
}
```